remove forget password feature

this now returns a 501 which the old website will handle